Cyber Centre Daily Advisory Digest — 2026-10-01 (5 advisories)
Cisco Catalyst SD-WAN Manager CVE-2026-76504 (API auth bypass) is actively exploited per CISA KEV; four other vendor advisories (JetBrains, OpenSSL, WatchGuard, HPE) also require urgent patching. Five vendor security advisories were published on 2026-10-01. CVE-2026-76504 in Cisco Catalyst SD-WAN Manager enables API authentication bypass and is listed in CISA's KEV database, confirming active exploitation. WatchGuard Fireware OS CVE-2026-86134 allows pre-authentication remote denial of service via NULL pointer dereference. HPE advisories include remote command execution on Compute Scale-up and Superdome Flex servers.
Detection / Hunteropenrouter
Immediate Actions
- Patch Cisco Catalyst SD-WAN Manager to fixed versions immediately
- Restrict network access to Cisco SD-WAN Manager API interfaces to management VLANs only
- Apply WatchGuard Fireware OS updates to prevent pre-auth remote DoS
- Update HPE server firmware to address remote command execution flaws
Key Takeaways
- CVE-2026-76504 added to CISA KEV on September 30, 2026
- Cisco SD-WAN Manager versions prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, 26.2.1 affected
- WatchGuard CVE-2026-86134 enables pre-auth remote DoS via NULL pointer dereference
- HPE advisories include remote command execution on Superdome Flex and Scale-up servers
- OpenSSL versions prior to 1.0.2zs, 1.1.1zj, 3.0.23, 3.4.8, 3.5.9, 3.6.5, 4.0.3 affected
Attack Chain
- Initial Access: Attacker exploits CVE-2026-76504 API authentication bypass on Cisco SD-WAN Manager
- Exploitation: Unauthenticated API access grants control of SD-WAN management plane
- Persistence: Attacker modifies SD-WAN configuration to maintain access to managed networks
- Lateral Movement: Attacker pivots through SD-WAN tunnels to reach downstream network segments
Affected Systems
- Cisco Catalyst SD-WAN Manager (multiple versions prior to 20.9.10.1 etc.)
- JetBrains Hub, IntelliJ IDEA, Rider, TeamCity, YouTrack
- OpenSSL (versions prior to 1.0.2zs through 4.0.3)
- WatchGuard Fireware OS (versions prior to 12.12.3, 12.5.21, 2026.2.3, 2026.3.2)
- HPE Instant ON, Telco Service Orchestrator, Compute Scale-up Servers, Superdome Flex Servers
- HPE Unified OSS Console (UOC)
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-76504 | Cisco Catalyst SD-WAN Manager | Critical | API authentication bypass allows unauthenticated access to SD-WAN management plane. |
| CVE-2026-86134 | WatchGuard Fireware OS | High | Pre-authentication NULL pointer dereference allows remote denial of service. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Vulnerabilities target network appliances and server firmware, not endpoints with EDR agents. |
| Network Visibility | Medium | API exploitation and DoS attempts may be visible in network flow logs and appliance logs. |
| Detection Difficulty | Moderate | Detecting exploitation of API auth bypass requires appliance-specific log analysis; no signatures published. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Unauthenticated API calls to Cisco SD-WAN Manager endpoints succeeding without prior authentication session (T1190) | SD-WAN Manager API access logs | Initial Access | Low — unauthenticated API success is abnormal |
| Inbound traffic to WatchGuard firewall causing NULL pointer dereference patterns or unexpected appliance restarts (T1499) | Fireware OS system logs and flow data | Impact | Medium — appliance restarts have benign causes |
| Remote command execution originating from HPE management interfaces on Superdome Flex servers (T1059) | HPE RMC and iLO management audit logs | Execution | Low — remote RMC command execution is rare |
Required Log Sources
- Cisco SD-WAN Manager API logs
- WatchGuard Fireware OS logs
- HPE iLO/RMC management logs
- Network flow logs
- Web application firewall logs
Key Behavioral Indicators
- Successful API calls to SD-WAN Manager without authentication tokens
- Unexpected WatchGuard appliance restarts or crashes from remote sources
- Command execution originating from HPE RMC management interfaces
- Unpatched Cisco SD-WAN Manager version strings in asset inventory
Control Gaps
- Network appliances lack EDR agent coverage
- API authentication bypass may not trigger WAF rules
- Firmware-level exploitation on HPE servers evades OS-level monitoring
- DoS via NULL pointer dereference may not trigger rate-based protections
False Positive Assessment
Low — appliance-level exploitation and unauthenticated API access produce distinct, abnormal log patterns.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Update OpenSSL to latest fixed versions across all services
- Patch JetBrains TeamCity and Hub to fixed versions
- Restrict HPE iLO and RMC management interfaces to dedicated management networks
- Enable API rate limiting and authentication logging on Cisco SD-WAN Manager
User Protection
- Update JetBrains IDEs (IntelliJ IDEA, Rider) to latest fixed versions
- Ensure HPE Instant ON APs are updated to versions above 3.4.1.0
- Update JetBrains YouTrack to fixed versions
MITRE ATT&CK Mapping
Initial Access
Execution
Impact
Plain-Language Summary
Five security advisories from Cisco, JetBrains, OpenSSL, WatchGuard, and HPE were published on October 1, 2026. The most urgent is a Cisco Catalyst SD-WAN Manager flaw (an authentication bypass in its API) that attackers are already exploiting in the wild. WatchGuard firewalls have a separate flaw allowing remote crash without login credentials. Administrators should review all five advisories and patch affected systems, prioritizing the Cisco product since active exploitation is confirmed.
- cveCVE-2026-76504API authentication bypass allows unauthenticated access to SD-WAN management plane.
- cveCVE-2026-86134Pre-authentication NULL pointer dereference allows remote denial of service.